Analysis
-
max time kernel
49s -
max time network
148s -
platform
android_x64 -
resource
android-x64-20240611.1-en -
resource tags
androidarch:x64arch:x86image:android-x64-20240611.1-enlocale:en-usos:android-10-x64system -
submitted
15-06-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x86-arm-20240611.1-en
Behavioral task
behavioral2
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x64-20240611.1-en
Behavioral task
behavioral3
Sample
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
Resource
android-x64-arm64-20240611.1-en
General
-
Target
ad3549428f982733f6cda941f9168d32_JaffaCakes118.apk
-
Size
3.0MB
-
MD5
ad3549428f982733f6cda941f9168d32
-
SHA1
7faf54893eb20e31db3ce2c6dd34ef72d51c5109
-
SHA256
f2246526f002e68a7672a2730dcce54b41fe604512054ff18f83cd5fabcc84b4
-
SHA512
ffae34ea519598c17fdccad3617139d719133835d3eae788656acc8d3def35edc123c47aadf6052b5d12e9a19191dfa799042e41779b3fc24de632fe75ca3cb9
-
SSDEEP
49152:039PNz37WFRagCb4qjH7OxofIsoES76khGgUUHWPORJund8cL0NLcXbYFv9Kvdv7:kL7gR3Cbfz7OxkCTG6QO3ud8G8LCuoVD
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Loads dropped Dex/Jar 1 TTPs 3 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.tw_words300mribioc pid process /data/user/0/com.tw_words300mrib/cache/1582435991586.jar 5050 com.tw_words300mrib /data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jar 5050 com.tw_words300mrib /data/user/0/com.tw_words300mrib/files/1718433815129b.jar 5050 com.tw_words300mrib -
Obtains sensitive information copied to the device clipboard 2 TTPs 1 IoCs
Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
-
Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
-
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.tw_words300mribdescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.tw_words300mrib -
Queries information about active data network 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.tw_words300mrib -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.tw_words300mribdescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.tw_words300mrib -
Queries the mobile country code (MCC) 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework service call com.android.internal.telephony.ITelephony.getNetworkCountryIsoForPhone com.tw_words300mrib -
Queries the unique device ID (IMEI, MEID, IMSI) 1 TTPs
-
Reads information about phone network operator. 1 TTPs
-
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.tw_words300mrib -
Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 1 IoCs
Processes:
com.tw_words300mribdescription ioc process Framework API call javax.crypto.Cipher.doFinal com.tw_words300mrib -
Checks CPU information 2 TTPs 1 IoCs
-
Checks memory information 2 TTPs 1 IoCs
Processes
-
com.tw_words300mrib1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Obtains sensitive information copied to the device clipboard
- Queries information about running processes on the device
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks CPU information
- Checks memory information
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.tw_words300mrib/cache/1582435991586.jarFilesize
9KB
MD5e8e0527a01aefdb89afd2c508f131da1
SHA1f1103e6b260c657ceb3d95f1b023af3fda8b133a
SHA256f809447486f89fcaa74f87e06d126d103d37eb2b3157e88f2c06d989b2c284ce
SHA512fb53683a83f1068d0f94567b156e6a8910c45b1b5f33db919f7e0b9c55eab28507a235ef76d44d5b549599ea3b54dbc00496a633339d276a80f395da938d6d34
-
/data/data/com.tw_words300mrib/databases/guest.dbFilesize
28KB
MD51207198661b2a8b746fd277a86bfe74e
SHA1e6ce5cf8b5aa942073239ae4959f06b5788f5bd1
SHA256f3e129f4eb449fa6c1e1b5a3f38a3b19da8bedd4ac95da2b45e0d303e2126f8e
SHA5128896c172d279cc6176e5d53b47bf944820408cbc169fd63f3e58de4ebbf6be645c89b87e51105d2a569e14a957cf8ff0bdd32122bcc3f577cb7e25bf9fd2e769
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
512B
MD515400be804b16e59aad0c39965534b81
SHA12a0351c58db4b6635857c9d6d3912f3ca9479e0d
SHA2565d5f07474dce41cd9ab8e822c2f0e82647986eca486d8e2093c8f571cccdb3dd
SHA512dbcca25674d59b712c2f948984668f815b474e397279c520dfa37d606f9dd62b0957a8cf38f93563a0e990e2774bd2ec67e4907098d815b3af9f2bcc4bf05527
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
8KB
MD5e46b088eaf9e9db7260f5aadfc3e28a6
SHA11f80e34768a2f7cf42120770ec33b3f512d6fe04
SHA256afe7046a1a54a48e1d44db3ae0f0bb22f7ac4dc8b0727e4820082b2559768c02
SHA51280a6ab231b4a1b2bf47c4a8bc22feb9e378f4170df1b8513fab6a6ce286fe31e4fb311536ed3bcf44e7484225920fa344c2c9e7f4571b716ca70a7ad2ad6e15a
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
8KB
MD55907e9e32c18b4deadcac90c5eabc57d
SHA1d3709e1567a8464adc0830e5555e3fbb8321a23a
SHA256e693416310620ba827d320c90ff52f2624e3f4aab313261182f8d9644244f3e5
SHA512f1fc4b38b6a2a14e5ec1b30bf7e1abb71be38d1a149b0bcf9c624bc7ca454ed02e4b40a0d76daa280519a17a38279038a279d221b20b155feed8faf5d0ae9ac0
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
12KB
MD5922ab343fd00d777eab663e0fddf6c83
SHA13683e9fc29188cd2bb73a3552cda407c07c4cbd6
SHA2563ad274488b3fe4cd75fa7f38ea238b06530a8b4fb4ecdeed33ff978c8b2418b1
SHA5121cd02ec66070bda07ff228ef6d69e092a6ca386d0adb0fb96985127600ad1609c79bb4cf3ae9f375a0653bb38a98d0bfb68462fdb653977f6fab5577b24b5087
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
12KB
MD519e8c1e81c483a017da95d582280288d
SHA1ab7aad2339ef8dc4ad913dad89d339bbd360e593
SHA2569b8211155165ac26ea7a95ece65788ea4f19852bddd5404727215615b4d7397d
SHA512cb5d5f6be9db82db3da72bdd66cbb31f07628e8a12869a82947287804460ccc6f84cdd163dfff1715ef1caa6d5579c69c2938569b8ebe8ee240962c61b3f85f4
-
/data/data/com.tw_words300mrib/databases/guest.db-journalFilesize
16KB
MD515d35416ec3e6063acadd6868e021d22
SHA1faf2b4193611ab29b93ae5bd492257e32bde115f
SHA256467e29e9d05a3a3102401fdf9725a4f443ffd0d0d48e10a63937dda804d30ac4
SHA512fa1738e1fd56c735f0a5e0cfdf962d584fed061b9ff7d10c219dd94a0a6d19a1133fb80d9f2d93feba77f84973b9dd5a9c8160396c59259672fdad79a064acaa
-
/data/data/com.tw_words300mrib/files/1718433815129b.jarFilesize
202KB
MD57b0966b78cae7137c0b71a62c774464c
SHA14f59edd544097834555f7c576f8529a67fac2e34
SHA256bb3f843f2f36340d0f98d78de1feaad6d5592963e85c712e93b127ab09b7712a
SHA5122449bbb5817e8a1c87e3f52cc18669923c7ebaec7cf39dccb6c193ac0d54202219cf4839946a836e7d534650b97ba0b84bdcbb375fdafe9269e3236e1b8c4c12
-
/data/data/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jarFilesize
43KB
MD50b9415889afc67442b2475098f2226eb
SHA127057c7f324f2b748a1721c4e964a8a516e1a73e
SHA25605ea8fae2e5a47d5795398d9957cdb8fd4b43bfef06a32acac5433d7ad3fee6f
SHA51208cedb67b73086aa372550fdb1d7a797c9cd10b2bbda203d89fde069151dfb323f7322ae07cb9d9580bdc96e268b1b576cdd30e381b296970a0a67aaa9412694
-
/data/user/0/com.tw_words300mrib/cache/1582435991586.jarFilesize
20KB
MD5fde2ee00cbd121cfab5290b078aa3ceb
SHA1e2b77d5320e155e413d040a8c20020962065b2f8
SHA2562897b0812077c654a9b3fbb0b6303d5cde681eeba7ad9981de65716c7810d685
SHA512a9326aff8e454a2b4ac09984ef2a65fddd4dc146b4c44d839035549bff8c9fdaae490326d0b018f76c1ca2e4fb25426d74f550ca0950982fba632a023af99a56
-
/data/user/0/com.tw_words300mrib/files/1718433815129b.jarFilesize
470KB
MD5dbe519e58153cf7c17d2d8ca27cb84bb
SHA13c14c5be0839a49809abdd37f265cb43f3b2ba54
SHA256595a8774153c52517d7ae99b43f48fb2a2d5299648cf2e7b73b0be5a842d41e5
SHA5122418edccb2debf1facca88ed2f2845f33e1efb0d907e37b697b61594b9039303761f3274e78c1bcb0b8bfae49333e72546c54faf68fe016283768823816988e1
-
/data/user/0/com.tw_words300mrib/files/coma.sdjfoa.sdfjaios.wcsywc.jarFilesize
114KB
MD5eba5fb8f2d4071032981ea1dd2273500
SHA1637a909485112e2cb5346f74af9fe408f4e68879
SHA256443757fb1f99e50f0e7f575c42a43482477d8a23853ce42ed3b1e092752e6c82
SHA51275d45bd8c4892fc26287ca6294e9cd29a4576091d2040feb2ae21be99d1ebc6f72812a513642450fad581e50d7d46d80831ebc4008f3bf199a1b45fcf96632ad